Compare Employee Communications Against Sec Referral Notice

---
name: compare-employee-communications-against-sec-referral
task_id: white-collar-defense-investigations/compare-employee-communications-against-sec-referral-notice
description: Gap analysis memorandum comparing collected employee communications against an SEC referral notice, identifying communication log gaps, potential spoliation, instructions to employees not to discuss the matter, and obstruction or whistleblower suppression exposure.
activates_for: [planner, solver, checker]
---

# Skill: Compare Employee Communications Against SEC Referral Notice — Defense-Side Gap Analysis

## 2. Failure modes the skill is correcting

- The memo treats the SEC referral notice as self-proving instead of testing it against the company’s actual communication record.
- Relevant employee messages are compared in the aggregate, masking date-specific gaps, BYOD capture issues, and custody/source differences.
- An unexplained gap is described without first ruling out ordinary causes such as migration, retention settings, device loss, or platform non-capture.
- An instruction not to discuss the matter is treated as routine confidentiality rather than a potential obstruction, evidence-preservation, or whistleblower-suppression indicator.
- The timing of management communications is not tied to the investigation timeline, weakening the inference analysis.
- The write-up stops at problem spotting and does not state the downstream litigation, regulatory, or privilege consequence.
- Recommendations are omitted or too generic to support immediate defense-side triage.
- Legal conclusions are stated without naming the governing rule, statute, regulation, or doctrine.

## 3. Legal frameworks / domain conventions that apply

**SEC referral notice as comparison anchor:**
- The referral notice frames alleged conduct, relevant custodians, date ranges, and categories of communications the SEC believes are material.
- The defense task is to compare that framing against collected employee communications and related documents to identify corroboration, contradiction, missing periods, and source-specific limitations.

**Communication-gap analysis:**
- Treat company-maintained records, archived systems, and personal-device communications as distinct populations.
- A gap is only probative after confirming the search universe, retention settings, and any technical or administrative explanation for non-capture.
- If no innocent explanation is documented, state that absence affirmatively and explain why it matters.

**Obstruction and evidence-preservation exposure:**
- Instructions not to discuss a matter, when linked to an inquiry, subpoena, complaint, or hold notice, may implicate obstruction or preservation duties.
- Anchor any such assessment to the governing source identified in the materials or to the applicable federal obstruction and evidence-preservation standards, including 18 U.S.C. §§ 1503, 1512, and Federal Rule of Civil Procedure 37(e) where preservation issues arise.

**Whistleblower-suppression / retaliation concerns:**
- Communications that discourage reporting to regulators or retaliation for reporting may implicate anti-retaliation and whistleblower protections.
- Cite the applicable securities-law source for the proposition relied on, including Exchange Act Rule 21F-17, 17 C.F.R. § 240.21F-17, and any other authority identified in the record.

**Privilege and defense posture:**
- The memorandum is privileged and should separate fact collection, legal risk assessment, and recommended next steps.
- Do not overstate conclusions where the source set is incomplete; identify what is known, what is missing, and what should be collected next.

## 4. Analytical scaffolds

1. **Scope the comparison universe**: Identify the custodians, systems, and time periods covered by the SEC referral and by the collected documents; if the record set is clearly limited to one relevant period or one communication channel, say so.
2. **Match allegation to record**: For each allegation or document reference in the referral notice, locate the corresponding employee communication, archive hit, or absence of a hit.
3. **Test for corroboration or contradiction**: Determine whether the communications support, undermine, or fail to address the referral’s narrative.
4. **Evaluate any gap**: For each missing period or missing custodian/channel, determine whether there is an innocent explanation in the record; if none appears, state that the gap is unexplained.
5. **Assess source limitations**: Distinguish between company records, personal devices, and third-party or ad hoc channels so that a source limitation is not mistaken for spoliation.
6. **Assess instruction language**: Identify any direction not to discuss, not to memorialize, or not to escalate; evaluate whether it is tied to a compliance inquiry, government contact, or complaint.
7. **Tie timing to the investigation**: State the date of the instruction and compare it to the start of the inquiry, hold, referral, subpoena, or complaint.
8. **State the defense consequence**: For each issue, explain whether the consequence is evidentiary weakness, preservation risk, obstruction exposure, whistleblower-suppression exposure, or a privilege-management issue.
9. **Cite the governing authority**: Name the statute, regulation, rule, or doctrine supporting each legal proposition used in the assessment.

## 5. Vertical / structural / temporal relationships

- Organize the analysis by chronology when timing drives the inference: alleged conduct period, first complaint or inquiry, hold implementation, and later communications.
- Distinguish upward and downward communication flows when management instructions may have been relayed through intermediaries.
- Separate company-controlled systems from off-system communications; a record gap in one does not prove absence in the other.
- Where multiple custodians or channels are involved, address each separately rather than collapsing them into a single narrative pass.
- Note whether a communication occurred before, during, or after the triggering event; proximity often changes the risk analysis.

## 6. Output structure conventions

- Deliver a privileged defense-side gap analysis memorandum in conventional memo form with a short executive summary followed by numbered issues.
- Open with a concise scope statement identifying the source set reviewed, the time period, and any material limitations.
- Define one ordinal severity scale at the top and apply it consistently to every issue, such as Critical / High / Medium / Low.
- For each issue, include:
  - the SEC allegation or document reference being tested;
  - the relevant employee communication record or absence of record;
  - the gap, corroboration, or contradiction identified;
  - the innocent-explanation check and whether it was satisfied;
  - the governing authority for any legal proposition cited;
  - the downstream consequence for the client;
  - the severity rating.
- Close each issue with a concrete action-oriented recommendation tied to the responsible role and the relevant milestone or urgency.
- Include a final Recommended Actions section covering supplemental collection, hold review, privilege handling, custodian follow-up, and any need for individual-counsel coordination.
- Keep the tone defensive, precise, and document-driven; avoid conclusory assertions unsupported by the source set.